activesupport 8.0.4 → 8.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32beba8624850f5da4cad945a95adadbf26c3469dc4da4f231412b37b6fbc070
-  data.tar.gz: 66eec5b8c43f67d79449762999acce95b9c73a93800197bdaca5f22033876819
+  metadata.gz: e4952a5142700edad7b5bf62c0753a93f202873d96a6ad7dd5b231348ec9d917
+  data.tar.gz: 7f832339286eeeec1fda1097ee5ad50b6efc3ae44bb1aa483524907dcb3aebd7
 SHA512:
-  metadata.gz: 1eb3ea47ffa973a4c8378e804c7bf69e03013d39b30f73e5a80285672fa8aa1d109385ea3b9dff14f438d38e39ee47e6333567a385cd3bf0a64371b7e546757b
-  data.tar.gz: f204a3f69b69120cd00b904589a0d6bdfbf0f9655c2f6fd20070af01799b1851dead84e44c9c3ef3af1f70e56cc4323de07dad8dc14128624aba904f48c9dd83
+  metadata.gz: 5b4825cf61610686c03d69e648665d4d886e1c755a0f3bc4db14d1bb81331e0c11a79d3c96295185972cb0852e894d66bdc03d2c6787e8c6f3629f4d18e8ce43
+  data.tar.gz: 5b7ee77d3c6a4f36a7746d2ce9a2d49d2cc18c9a4e17931626d3dc87c09edb12236180a6ef5d1c7dddcbf7cdafed9d97edb9b9146ed0d56231b286573f41795b

data/CHANGELOG.md

@@ -1,3 +1,57 @@
+## Rails 8.0.5 (March 24, 2026) ##
+
+*   Fix inflections to better handle overlapping acronyms.
+
+    ```ruby
+    ActiveSupport::Inflector.inflections(:en) do |inflect|
+      inflect.acronym "USD"
+      inflect.acronym "USDC"
+    end
+
+    "USDC".underscore # => "usdc"
+    ```
+
+    *Said Kaldybaev*
+
+*   Silence Dalli 4.0+ warning when using `ActiveSupport::Cache::MemCacheStore`.
+
+    *zzak*
+
+*   Make `delegate` and `delegate_missing_to` work in BasicObject subclasses.
+
+    *Rafael Mendonça França*
+
+*   Fix `ActiveSupport::Inflector.humanize` with international characters.
+
+    ```ruby
+    ActiveSupport::Inflector.humanize("áÉÍÓÚ")  # => "Áéíóú"
+    ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде"
+    ```
+
+    *Jose Luis Duran*
+
+
+## Rails 8.0.4.1 (March 23, 2026) ##
+
+*   Reject scientific notation in NumberConverter
+
+    [CVE-2026-33176]
+
+    *Jean Boussier*
+
+*   Fix `SafeBuffer#%` to preserve unsafe status
+
+    [CVE-2026-33170]
+
+    *Jean Boussier*
+
+*   Improve performance of NumberToDelimitedConverter
+
+    [CVE-2026-33169]
+
+    *Jean Boussier*
+
+
 ## Rails 8.0.4 (October 28, 2025) ##
 
 *   Fix `Enumerable#sole` to return the full tuple instead of just the first element of the tuple.
@@ -64,6 +118,26 @@
 
     *Jason T Johnson*, *Jean Boussier*
 
+    **Note on overwrite precedence:**
+
+    This fix also changed the overwrite precedence when distinct keys are transformed into the same key.
+    The later key now overwrites the earlier one (matching standard Ruby `Hash` behavior).
+    Previously, the earlier key's value was preserved.
+
+    Before:
+
+    ```ruby
+    >> {XY: 1, xy: 2}.with_indifferent_access.transform_keys!(&:downcase)
+    => {"xy"=>1}
+    ```
+
+    After:
+
+    ```ruby
+    >> {XY: 1, xy: 2}.with_indifferent_access.transform_keys!(&:downcase)
+    => {"xy"=>2}
+    ```
+
 *   Fix `ActiveSupport::Cache::MemCacheStore#read_multi` to handle network errors.
 
     This method specifically wasn't handling network errors like other codepaths.

data/lib/active_support/cache/mem_cache_store.rb

@@ -60,7 +60,7 @@ module ActiveSupport
         pool_options = retrieve_pool_options(options)
 
         if pool_options
-          ConnectionPool.new(pool_options) { Dalli::Client.new(addresses, options.merge(threadsafe: false)) }
+          ConnectionPool.new(**pool_options) { Dalli::Client.new(addresses, options.merge(threadsafe: false)) }
         else
           Dalli::Client.new(addresses, options)
         end
@@ -90,6 +90,9 @@ module ActiveSupport
         # The value "compress: false" prevents duplicate compression within Dalli.
         @mem_cache_options[:compress] = false
         (OVERRIDDEN_OPTIONS - %i(compress)).each { |name| @mem_cache_options.delete(name) }
+        # Set the default serializer for Dalli to prevent warning about
+        # inheriting the default serializer.
+        @mem_cache_options[:serializer] = Marshal
         @data = self.class.build_mem_cache(*(addresses + [@mem_cache_options]))
       end
 

data/lib/active_support/cache/redis_cache_store.rb

@@ -150,7 +150,7 @@ module ActiveSupport
         universal_options = redis_options.extract!(*UNIVERSAL_OPTIONS)
 
         if pool_options = self.class.send(:retrieve_pool_options, redis_options)
-          @redis = ::ConnectionPool.new(pool_options) { self.class.build_redis(**redis_options) }
+          @redis = ::ConnectionPool.new(**pool_options) { self.class.build_redis(**redis_options) }
         else
           @redis = self.class.build_redis(**redis_options)
         end

data/lib/active_support/core_ext/object/json.rb

@@ -4,7 +4,7 @@
 require "json"
 require "bigdecimal"
 require "ipaddr"
-require "uri/generic"
+require "uri"
 require "pathname"
 require "active_support/core_ext/big_decimal/conversions" # for #to_s
 require "active_support/core_ext/hash/except"

data/lib/active_support/core_ext/string/inflections.rb

@@ -248,7 +248,7 @@ class String
   # optional parameter +capitalize+ to false.
   # By default, this parameter is true.
   #
-  # The trailing '_id' can be kept and capitalized by setting the
+  # The trailing '_id' can be kept by setting the
   # optional parameter +keep_id_suffix+ to true.
   # By default, this parameter is false.
   #

data/lib/active_support/core_ext/string/output_safety.rb

@@ -128,7 +128,9 @@ module ActiveSupport # :nodoc:
         escaped_args = Array(args).map { |arg| explicit_html_escape_interpolated_argument(arg) }
       end
 
-      self.class.new(super(escaped_args))
+      new_safe_buffer = self.class.new(super(escaped_args))
+      new_safe_buffer.instance_variable_set(:@html_safe, @html_safe)
+      new_safe_buffer
     end
 
     attr_reader :html_safe

data/lib/active_support/delegation.rb

@@ -134,11 +134,11 @@ module ActiveSupport
               "def #{method_name}(#{definition})" <<
               "  _ = #{receiver}" <<
               "  _.#{method}(#{definition})" <<
-              "rescue NoMethodError => e" <<
+              "rescue ::NoMethodError => e" <<
               "  if _.nil? && e.name == :#{method}" <<
-              "    raise ::ActiveSupport::DelegationError.nil_target(:#{method_name}, :'#{receiver}')" <<
+              "    ::Kernel.raise ::ActiveSupport::DelegationError.nil_target(:#{method_name}, :'#{receiver}')" <<
               "  else" <<
-              "    raise" <<
+              "    ::Kernel.raise" <<
               "  end" <<
               "end"
           end
@@ -151,49 +151,32 @@ module ActiveSupport
         target = target.to_s
         target = "self.#{target}" if RESERVED_METHOD_NAMES.include?(target) || target == "__target"
 
-        if allow_nil
-          owner.module_eval <<~RUBY, __FILE__, __LINE__ + 1
-            def respond_to_missing?(name, include_private = false)
-              # It may look like an oversight, but we deliberately do not pass
-              # +include_private+, because they do not get delegated.
-
-              return false if name == :marshal_dump || name == :_dump
-              #{target}.respond_to?(name) || super
-            end
-
-            def method_missing(method, ...)
-              __target = #{target}
-              if __target.nil? && !nil.respond_to?(method)
-                nil
-              elsif __target.respond_to?(method)
-                __target.public_send(method, ...)
-              else
-                super
-              end
-            end
-          RUBY
+        nil_behavior = if allow_nil
+          "nil"
         else
-          owner.module_eval <<~RUBY, __FILE__, __LINE__ + 1
-            def respond_to_missing?(name, include_private = false)
-              # It may look like an oversight, but we deliberately do not pass
-              # +include_private+, because they do not get delegated.
+          "::Kernel.raise ::ActiveSupport::DelegationError.nil_target(method, :'#{target}')"
+        end
 
-              return false if name == :marshal_dump || name == :_dump
-              #{target}.respond_to?(name) || super
-            end
+        owner.module_eval <<~RUBY, __FILE__, __LINE__ + 1
+          def respond_to_missing?(name, include_private = false)
+            # It may look like an oversight, but we deliberately do not pass
+            # +include_private+, because they do not get delegated.
 
-            def method_missing(method, ...)
-              __target = #{target}
-              if __target.nil? && !nil.respond_to?(method)
-                raise ::ActiveSupport::DelegationError.nil_target(method, :'#{target}')
-              elsif __target.respond_to?(method)
-                __target.public_send(method, ...)
-              else
-                super
-              end
+            return false if name == :marshal_dump || name == :_dump
+            #{target}.respond_to?(name) || super
+          end
+
+          def method_missing(method, ...)
+            __target = #{target}
+            if __target.nil? && !nil.respond_to?(method)
+              #{nil_behavior}
+            elsif __target.respond_to?(method)
+              __target.public_send(method, ...)
+            else
+              super
             end
-          RUBY
-        end
+          end
+        RUBY
       end
     end
   end

data/lib/active_support/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveSupport
   module VERSION
     MAJOR = 8
     MINOR = 0
-    TINY  = 4
+    TINY  = 5
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/active_support/inflector/inflections.rb

@@ -248,7 +248,8 @@ module ActiveSupport
 
       private
         def define_acronym_regex_patterns
-          @acronym_regex             = @acronyms.empty? ? /(?=a)b/ : /#{@acronyms.values.join("|")}/
+          sorted_acronyms = @acronyms.empty? ? [] : @acronyms.values.sort_by { |a| -a.length }
+          @acronym_regex             = sorted_acronyms.empty? ? /(?=a)b/ : /#{sorted_acronyms.join("|")}/
           @acronyms_camelize_regex   = /^(?:#{@acronym_regex}(?=\b|[A-Z_])|\w)/
           @acronyms_underscore_regex = /(?:(?<=([A-Za-z\d]))|\b)(#{@acronym_regex})(?=\b|[^a-z])/
         end

data/lib/active_support/inflector/methods.rb

@@ -119,7 +119,7 @@ module ActiveSupport
     # The capitalization of the first word can be turned off by setting the
     # +:capitalize+ option to false (default is true).
     #
-    # The trailing '_id' can be kept and capitalized by setting the
+    # The trailing '_id' can be kept by setting the
     # optional parameter +keep_id_suffix+ to true (default is false).
     #
     #   humanize('employee_salary')                  # => "Employee salary"
@@ -143,13 +143,13 @@ module ActiveSupport
         result.delete_suffix!(" id")
       end
 
-      result.gsub!(/([a-z\d]+)/i) do |match|
+      result.gsub!(/([[[:alpha:]]\d]+)/i) do |match|
         match.downcase!
         inflections.acronyms[match] || match
       end
 
       if capitalize
-        result.sub!(/\A\w/) do |match|
+        result.sub!(/\A[[:alpha:]]/) do |match|
           match.upcase!
           match
         end

data/lib/active_support/isolated_execution_state.rb

@@ -56,11 +56,13 @@ module ActiveSupport
         scope.current
       end
 
-      def share_with(other)
+      def share_with(other, except: [])
         # Action Controller streaming spawns a new thread and copy thread locals.
         # We do the same here for backward compatibility, but this is very much a hack
         # and streaming should be rethought.
-        context.active_support_execution_state = other.active_support_execution_state.dup
+        state = other.active_support_execution_state.dup
+        Array(except).each { |key| state.delete(key) }
+        context.active_support_execution_state = state
       end
 
       private

data/lib/active_support/message_pack/extensions.rb

@@ -4,7 +4,7 @@ require "bigdecimal"
 require "date"
 require "ipaddr"
 require "pathname"
-require "uri/generic"
+require "uri"
 require "msgpack/bigint"
 require "active_support/hash_with_indifferent_access"
 require "active_support/time"

data/lib/active_support/number_helper/number_converter.rb

@@ -180,7 +180,7 @@ module ActiveSupport
           when Float, Rational
             number.to_d(0)
           when String
-            BigDecimal(number, exception: false)
+            BigDecimal(number, exception: false) unless number.to_s.match?(/[de]/i)
           else
             number.to_d rescue nil
           end

data/lib/active_support/number_helper/number_to_delimited_converter.rb

@@ -16,9 +16,24 @@ module ActiveSupport
       private
         def parts
           left, right = number.to_s.split(".")
-          left.gsub!(delimiter_pattern) do |digit_to_delimit|
-            "#{digit_to_delimit}#{options[:delimiter]}"
+          if delimiter_pattern
+            left.gsub!(delimiter_pattern) do |digit_to_delimit|
+              "#{digit_to_delimit}#{options[:delimiter]}"
+            end
+          else
+            left_parts = []
+            offset = left.size % 3
+            if offset > 0
+              left_parts << left[0, offset]
+            end
+
+            (left.size / 3).times do |i|
+              left_parts << left[offset + (i * 3), 3]
+            end
+
+            left = left_parts.join(options[:delimiter])
           end
+
           [left, right].compact
         end
 

data/lib/active_support/test_case.rb

@@ -45,6 +45,12 @@ module ActiveSupport
         ActiveSupport.test_order ||= :random
       end
 
+      if Minitest.respond_to? :run_order # MT6 API change
+        def run_order # :nodoc:
+          test_order
+        end
+      end
+
       # Parallelizes the test suite.
       #
       # Takes a +workers+ argument that controls how many times the process

data/lib/active_support/testing/assertions.rb

@@ -120,7 +120,8 @@ module ActiveSupport
           actual = exp.call
           rich_message = -> do
             code_string = code.respond_to?(:call) ? _callable_to_source_string(code) : code
-            error = "`#{code_string}` didn't change by #{diff}, but by #{actual - before_value}"
+            error = "`#{code_string}` didn't change by #{diff}, but by #{actual - before_value}."
+            error = "#{error}\n#{diff before_value + diff, actual}" if Minitest::VERSION > "6"
             error = "#{message}.\n#{error}" if message
             error
           end
@@ -212,7 +213,7 @@ module ActiveSupport
         rich_message = -> do
           code_string = expression.respond_to?(:call) ? _callable_to_source_string(expression) : expression
           error = "`#{code_string}` didn't change"
-          error = "#{error}. It was already #{to.inspect}" if before == to
+          error = "#{error}. It was already #{to.inspect}." if before == to
           error = "#{message}.\n#{error}" if message
           error
         end
@@ -268,8 +269,9 @@ module ActiveSupport
 
         rich_message = -> do
           code_string = expression.respond_to?(:call) ? _callable_to_source_string(expression) : expression
-          error = "`#{code_string}` changed"
+          error = "`#{code_string}` changed."
           error = "#{message}.\n#{error}" if message
+          error = "#{error}\n#{diff before, after}" if Minitest::VERSION > "6"
           error
         end
 
@@ -318,6 +320,9 @@ module ActiveSupport
             lines[0] = lines[0].byteslice(location[1]...)
             source = lines.join.strip
 
+            # Strip stabby lambda from Ruby 4.1+
+            source = source.sub(/^->\s*/, "")
+
             # We ignore procs defined with do/end as they are likely multi-line anyway.
             if source.start_with?("{")
               source.delete_suffix!("}")

data/lib/active_support/testing/autorun.rb

@@ -2,4 +2,9 @@
 
 require "minitest"
 
+# This respond_to check handles tests running sub-processes in an
+# unbundled environment, which triggers MT5 usage. This conditional may
+# be removable after the version bump, though it currently safeguards
+# against issues in environments with multiple versions installed.
+Minitest.load :rails if Minitest.respond_to? :load
 Minitest.autorun

data/lib/active_support/testing/parallelization/worker.rb

@@ -47,7 +47,11 @@ module ActiveSupport
           set_process_title("#{klass}##{method}")
 
           result = klass.with_info_handler reporter do
-            Minitest.run_one_method(klass, method)
+            if Minitest.respond_to? :run_one_method
+              Minitest.run_one_method klass, method
+            else
+              klass.new(method).run
+            end
           end
 
           safe_record(reporter, result)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activesupport
 version: !ruby/object:Gem::Version
-  version: 8.0.4
+  version: 8.0.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -494,10 +494,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.0.4/activesupport/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.0.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.0.5/activesupport/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.0.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.0.4/activesupport
+  source_code_uri: https://github.com/rails/rails/tree/v8.0.5/activesupport
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--encoding"
@@ -515,7 +515,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: A toolkit of support libraries and Ruby core extensions extracted from the
   Rails framework.